{
  "contract_version": "1.0.0",
  "source_requirements": ["plan-0.6", "readiness-B7"],
  "policy": {
    "read_only": true,
    "fail_closed": true,
    "unknown_access_status": "BLOCKED",
    "allowed_statuses": ["PASS", "FAIL", "BLOCKED"],
    "evidence_redaction": "values matching secret-bearing names, URL userinfo, query strings, and credentials must not be recorded"
  },
  "deployment": {
    "frontend": {"provider": "cloudflare", "origin": "https://tools.press.zone"},
    "api": {"provider": "cloudpanel", "origin": "https://api.press.zone", "host": "cloudpanel01"},
    "worker": {"provider": "cloudpanel", "host": "cloudpanel01", "separate_process": true},
    "database": {"engine": "postgresql", "access": "@platform-modules/db"},
    "object_storage": {"kind": "private-s3-compatible", "source_ttl_hours": 48, "zip_ttl_hours": 48},
    "session": {
      "frontend_origin": "https://tools.press.zone",
      "api_origin": "https://api.press.zone",
      "cookie": {"secure": true, "same_site": true, "http_only": true},
      "cors": {"allowed_origins": ["https://tools.press.zone"], "allow_credentials": true, "wildcard": false},
      "csrf": {"required_for_cookie_authenticated_mutations": true}
    }
  },
  "required_secrets": [
    {"name": "DATABASE_URL", "scope": "api-worker"},
    {"name": "SESSION_SECRET", "scope": "api"},
    {"name": "S3_ENDPOINT", "scope": "api-worker"},
    {"name": "S3_REGION", "scope": "api-worker"},
    {"name": "S3_BUCKET", "scope": "api-worker"},
    {"name": "S3_ACCESS_KEY_ID", "scope": "api-worker"},
    {"name": "S3_SECRET_ACCESS_KEY", "scope": "api-worker"},
    {"name": "STRIPE_SECRET_KEY", "scope": "api"},
    {"name": "STRIPE_WEBHOOK_SECRET", "scope": "api"}
  ],
  "probes": [
    {"id": "cloudflare-frontend", "kind": "https", "target": "https://tools.press.zone/", "required": true},
    {"id": "cloudpanel-api-route", "kind": "https", "target_env": "PDF2HTML_API_HEALTH_URL", "required": true},
    {"id": "cloudpanel-worker", "kind": "evidence", "evidence_env": "PDF2HTML_WORKER_EVIDENCE", "required": true},
    {"id": "postgres-platform-db", "kind": "evidence", "evidence_env": "PDF2HTML_POSTGRES_EVIDENCE", "required": true},
    {"id": "private-s3-lifecycle", "kind": "evidence", "evidence_env": "PDF2HTML_S3_LIFECYCLE_EVIDENCE", "required": true},
    {"id": "dns-tls-origin", "kind": "dns_tls", "host": "api.press.zone", "required": true},
    {"id": "split-origin-session", "kind": "cors", "target_env": "PDF2HTML_API_CORS_PROBE_URL", "origin": "https://tools.press.zone", "required": true},
    {"id": "required-secret-names", "kind": "secret_names", "required": true}
  ]
}